CVE-2006-1083

Multiple directory traversal vulnerabilities in PHP-Stats 0.1.9.1 and earlier allow remote attackers to read and possibly execute arbitrary files via a .. (dot dot) in the (1) option[language] and (2) option[template] parameters, and (3) possibly other parameters, to (a) admin.php and (b) other unspecified scripts. NOTE: the admin.php/option[language] vector can be used by remote unauthenticated attackers to include arbitrary files in conjunction with CVE-2006-1085.

• http://retrogod.altervista.org/php_stats_0191_adv.htmlExploit
• http://secunia.com/advisories/19116Vendor Advisory
• http://www.phpstats.net/forum/viewtopic.php?t=140
• http://www.securityfocus.com/archive/1/426762/100/0/threaded
• http://www.securityfocus.com/archive/1/428614/100/0/threaded
• http://www.securityfocus.com/archive/1/429145/100/0/threaded
• http://www.securityfocus.com/bid/16963
• http://www.vupen.com/english/advisories/2006/0822
• http://retrogod.altervista.org/php_stats_0191_adv.htmlExploit
• http://secunia.com/advisories/19116Vendor Advisory
• http://www.phpstats.net/forum/viewtopic.php?t=140
• http://www.securityfocus.com/archive/1/426762/100/0/threaded
• http://www.securityfocus.com/archive/1/428614/100/0/threaded
• http://www.securityfocus.com/archive/1/429145/100/0/threaded
• http://www.securityfocus.com/bid/16963
• http://www.vupen.com/english/advisories/2006/0822

Published

Mar 9, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1077Multiple cross-site scripting (XSS) vulnerabilities in the c…
• CVE-2006-1078Multiple buffer overflows in htpasswd, as used in Acme thttp…8.4
• CVE-2006-1079htpasswd, as used in Acme thttpd 2.25b and possibly other pr…
• CVE-2006-1080Cross-site scripting (XSS) vulnerability in login.php in Gam…
• CVE-2006-1081SQL injection vulnerability in forgotten_password.php in Jon…
• CVE-2006-1082Multiple cross-site scripting (XSS) vulnerabilities in phpAr…
• CVE-2006-1084Multiple SQL injection vulnerabilities in PHP-Stats 0.1.9.1 …
• CVE-2006-1085admin.php in PHP-Stats 0.1.9.1 and earlier allows remote att…
• CVE-2006-1086Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2006-1087Direct static code injection vulnerability in the modify_con…
• CVE-2006-1088PHP-Stats 0.1.9.1 and earlier allows remote attackers to obt…
• CVE-2006-1089Cross-site scripting (XSS) vulnerability in header.php in Pu…